The full stories.

Downtime

Self-hosted uptime monitoring: HTTP, TCP, DNS, ping and SQL checks, plus a dead man’s switch for jobs that are supposed to call in and go quiet instead. Ten notification channels, from Slack and PagerDuty to signed webhooks, behind a durable outbox that retries, deduplicates and dead-letters rather than dropping an alert.

What separates it from the hosted tools is where the answer comes from. Lightweight probers run in other networks and dial out to the hub, so a monitor resolves per region and you pick the policy: all of them agree, any one of them, or a quorum. A service unreachable from one continent stops looking like a global outage, and no single prober going dark takes the monitoring with it.

One Go binary with the interface compiled into it, SQLite underneath, and a leaderless mesh so several hubs run without one of them being in charge. It watches our production systems today, in place of a hosted synthetic monitoring service. Version 0.1.0, so treat it as early.

Vibe Coder

A platform that runs AI coding agents and developer workspaces as Kubernetes pods, with a chat interface in front of them. Each agent has its own pod, its own git home and its own credentials, and the platform handles provisioning, model access and lifecycle.

Behind it sit an LLM gateway that routes to several providers with per-agent keys, budgets and usage records, a broker that hands an agent short-lived and scope-limited access to other clusters, and a media stack that remuxes and transcodes on demand.

Roughly 8,000 commits since February 2026. We use it every day, it runs in preprod, and hosting agents for third parties is designed rather than shipped.

What we added since

1. 2026

   Cluster provisioning

   Kubernetes clusters created and upgraded from a form, on Hetzner with Talos underneath. No Terraform and no cloud SDK: the infrastructure calls are ours, and a rolling Talos or Kubernetes upgrade will not proceed until etcd reports itself healthy.

Kubesight

Operating fleets of Kubernetes clusters for years taught us what was missing: visibility that engineers actually use.

Kubesight is our answer. See your clusters clearly: fast, visual, no bullshit.

kubesight.ai →

Emporium

An experiment in what a self-hosted app store for Kubernetes could be: pick an application from a catalogue and have it deployed, kept up to date and put behind single sign-on without wiring any of that yourself.

The part worth keeping was the ordering. A mutating admission webhook rewrote every ingress to point at an authenticating proxy before the object was admitted, so an application was never reachable from the internet without a login, not even briefly. Software with no login of its own inherited one.

We stopped in 2025. The artifact registry it produced is still in production and serves our infrastructure today.

Artifacts

We built it because getting Nexus to fit our pipelines kept costing more than it saved. Instead of working around it we implemented the protocols ourselves: the Docker registry API, Helm repositories, npm, Maven and NuGet, all in one service, with caching proxy modes for Docker, npm and Maven and storage on a filesystem, S3 or Azure Blob.

It has run in production since 2021 and carries hundreds of builds a day inside DevCloud. That is also why it is tuned hard for speed: a registry that hesitates taxes every build in the company, several times an hour, forever.

Every container image behind our own infrastructure comes out of it too, including the one serving this website.

DevCloud

A bank needs the speed of a startup and the control of a regulated institution. DevCloud is the developer platform that delivers both: self-service project and permission management, instantly provisioned Kubernetes clusters with networking, authentication, logging and monitoring included, integrated CI and collaboration tooling, and a CLI developers actually enjoy using.

Today more than 2,000 people work with it every day, along with 40 vendors, on 100+ clusters in production. Setting up an environment took weeks and now takes hours, which is the bank’s own published figure. Microsoft wrote a customer story about it, and the bank has written about the platform twice.

We built DevCloud in 2018, and we operate it to this day.

Microsoft wrote a case study about it →

Julius Baer’s own engineers wrote about it →

Julius Baer on the platform behind its agile transformation →

What we added since

1. One project, every tool

   Creating a project provisions the whole workspace behind it, from issue tracking and wikis to git, CI, code quality and chat, each with the right people already in it. Nobody files a ticket to get access to anything.

2. Self-service clusters

   A team creates its own cluster, scales its node pools and upgrades it, and an upgrade will not start until it has checked the pod disruption budgets. Scheduled backups and custom domains with nameserver verification come with it.

3. A marketplace of ready services

   Around thirty pre-configured services, from Postgres and Kafka to Elasticsearch and Jupyter, deployed into a project in a few clicks and reporting their own lifecycle and power state back.

4. An audit trail a bank can read

   Every change is recorded with who made it and what it was before: cluster settings, node pool sizes, project flags, and which roles were added to or removed from which person.

5. Global ingress authentication

   One switch puts OAuth2 in front of every ingress in a cluster, so a service with no login of its own is never exposed without one.

6. What it costs, per project

   Cloud cost per project, broken down by category and charted daily. Tool licences too, and a licence nobody has touched for ninety days is reclaimed automatically.

7. A command line that hands out no credentials

   One binary sets up your cluster and registry access, and the kubeconfig it writes mints a short-lived token per call rather than leaving a long-lived credential on anyone’s laptop.

8. The artifact repository, provisioned for you

   Repositories created per project, credentials scoped and given an expiry, upstream caches configured and retention cleanup recorded in the audit log, without anyone logging into the registry to set it up.

   See Artifacts

9. 2026

   The ingress converter

   Teams kept writing ordinary Ingress objects. Underneath, a converter turned each one into Gateway API resources on Envoy, so the platform moved off ingress-nginx without anybody rewriting a manifest or booking a maintenance window.

10. autovpa

    Vertical pod autoscaler objects configured automatically across the platform, on by default, with a per-workload opt-out for the few that should be left alone.

Mammut Connect

Mammut Connect bridges physical products and digital experience. NFC and QR give every product its own identity, story and services on iOS and Android.

Digital hangtags support the sale before the purchase; registration, warranty and care instructions follow after it. Behind the experience: backend microservices, centralized identity management and analytics that feed product innovation.

Cloud-native for the federal government

For the Swiss Federal Office of Information Technology (BIT) we supported the establishment of a Platform-as-a-Service infrastructure that empowers internal teams and streamlines application deployment.

We built the integration connecting applications on Cloud Foundry with services on Kubernetes, including secure provisioning of critical services. And we trained BIT personnel to run all of it without us: knowledge transfer as a deliverable, not a risk.

Swisscom myCloud

Switzerland’s cloud storage for consumers: photos, videos and documents, hosted exclusively in Swiss data centers.

We helped design and implement the scalable backend: automatic photo backup, sharing, galleries and cross-device synchronization for millions of users, with data privacy as a design constraint rather than an afterthought.

Monostream Flux

A software-defined NPVR platform built in partnership with Hewlett Packard Enterprise: live TV streaming and digital video recording on commodity hardware instead of specialized appliances.

Grid computing, clustered storage and sophisticated video processing record hundreds of channels in parallel, with upgrades that never interrupt a running stream. Transmuxing serves HLS, Smooth Streaming and MP4 to thousands of concurrent viewers from an intelligent cache.

Swisscom TV 2.0

Middleware, architecture and applications for a national multiscreen TV platform serving over one million Swisscom customers: live TV, video-on-demand and sports across every screen.

The platform won a TV Connect Award, built on the streaming technologies of its era: Silverlight, HLS, Smooth Streaming and DRM, extended with specialized Mediaroom applications.

Swisscom TV Air

The App Store had opened in mid-2008. We started building in 2009 and shipped Swisscom TV Air in 2010: live TV, sports and video-on-demand on the iPhone, among the first apps of its kind anywhere.

It was never just an app. We built the backend services and a web client too, so the same platform served mobile and browser viewers alike.

Vismolog

Monostream started with a problem nobody had a name for yet: industrial climate installations around the world needed monitoring. Remotely, reliably, and at scale. We built Vismolog to do exactly that.

Years later the industry started calling this IoT. By then the system had been running in production for years.